← Anvil

Privacy Policy

This Privacy Policy explains how Anvil (“Anvil”, “we”, “us”) collects, uses, and protects personal data when you use Anvil, our platform for running Old School RuneScape clan events at anvilosrs.com.

1. Who we are

Anvil is the data controller for account and billing data described below. For the clan data you and your members put into the platform, you (the clan operator) are the controller and we act as your processor, storing and processing it on your behalf.

2. Data we collect

  • Account & contact: your email address and the Discord identity you sign in with (Discord user ID, username, avatar).
  • Billing: subscription tier and status, and limited transaction metadata. Payment-card details are collected and processed by Gumroad — we do not see or store full card numbers.
  • Clan data (processed on your behalf): roster and player information your clan enters (such as RuneScape names and Discord IDs), event and competition data, and images uploaded as drop or fee proof.
  • Discord bot interactions: when someone runs one of the bot’s slash commands (such as /bingo) in a server the bot has been added to, Discord sends us the command used, its arguments, the server and channel it was run in, and the Discord user ID of the person who ran it. The user ID is used to look that person up on the clan’s roster so the reply is about them; the interaction itself is not stored, and the bot does not read ordinary chat messages.
  • Connected streaming accounts (Twitch, Kick, YouTube): only if you connect one. See section 4a for exactly what is read and kept.
  • Technical: log data such as IP address, request metadata, and error diagnostics, used to operate and secure the service.
  • Fair-play checks: to help a clan’s staff spot boosted or shared accounts in its events, we compare the hiscores, personal bests and play times the plugin and hiscores already give us. On events whose organiser turns on account-sharing checks (the event’s rules say so), we also record which network and country the plugin connects from: never the IP address itself, only a code that can be matched within that one event, and Cloudflare’s country guess. These results are shown to the clan’s staff only. They are reasons for a person to take a look, never an automatic penalty.

3. How we use data

  • To run, maintain, and back up the platform and your clan’s data on it.
  • To process subscriptions, prevent fraud, and provide support.
  • To communicate service, billing, and security notices.
  • To secure, monitor, and improve the service, and to comply with legal obligations.

Our legal bases (where the GDPR applies) are performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.

4. Service providers (sub-processors)

We share data with the following providers only as needed to run the service:

  • Gumroad — payments, billing, and tax as Merchant of Record. See its privacy notice.
  • Hetzner Online GmbH — server hosting (Germany / EU).
  • Cloudflare, Inc. — DNS, network/security, and R2 object storage for uploaded media.
  • Discord, Inc. — authentication (login) and, where you enable it, bot integrations for your clan.
  • Twitch Interactive, Inc., Kick Streaming Pty Ltd and Google LLC (YouTube) — only when you connect an account on one of them; see section 4a.
  • Jagex Hiscores — public OSRS Hiscores are queried to refresh competition stats; we send RuneScape names you provide.

4a. Connected streaming accounts (Twitch, Kick, YouTube)

Streamers can limit who joins their events to their followers, subscribers or channel members, and can let a chat bot answer !join with their event link. Connecting an account is always optional and something you start yourself.

  • If you join a streamer’s event as a viewer: we use your sign-in only to learn which account is yours and whether you follow, subscribe to or are a member of that streamer’s channel. We keep your account’s ID and name, and that yes/no answer with the time we checked. We do not keep your access token: it is used once and then revoked.
  • If you connect your own channel as a host: we keep your channel’s ID and name and an access token, encrypted, so we can check your followers or subscribers when someone joins, and (if you turn it on) reply to !join in your chat. On Kick we also receive your channel’s chat messages, follows and subscriptions as they happen; we keep only the follow and subscription facts and codes typed to link an account, never the chat itself.
  • Never shared or sold. This information is used only to decide who may join the events you take part in or host. It is not shown to anyone else, used for advertising, or passed to other parties.
  • Removing it: disconnect the account in Anvil at any time and we delete the stored ID, name, tokens and checks. You can also revoke Anvil’s access from the platform itself (for Google, at Google security settings).

YouTube. Anvil uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy. We request read-only access (youtube.readonly) and use it only to read your channel’s ID and name, whether you subscribe to a host’s channel, and, while a host is live, the author of a chat message containing your joining code. Anvil’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

4b. How we protect your data

We treat the access tokens and account details from connected accounts (including data received from Google APIs) as sensitive data, and protect them as follows:

  • Encryption in transit: all traffic to Anvil uses HTTPS (TLS), with HSTS enforced, and every request we make to Google, Twitch and Kick is made over HTTPS.
  • Encryption at rest: the only tokens we store (a host’s connected channel) are encrypted with AES-256-GCM before they are written to the database. The encryption key is kept separately from the database, so a copy of the database or its backups alone cannot be used to read them.
  • Minimal data, minimal time: we request only read-only access (youtube.readonly for YouTube). A viewer’s token is used for a single check and revoked straight away, never stored. A subscription or membership check is trusted for one day and then checked again. Disconnecting an account deletes its stored ID, name, tokens and checks.
  • Restricted access: our servers are not reachable directly from the internet: web traffic arrives only through Cloudflare, and a firewall blocks every other inbound connection except restricted administrative access. The database is reachable only from our own application. Only the operator of Anvil has administrative access to production systems.
  • No human reading: no person reads data received from Google APIs unless you ask us to (for example, for support), it is needed for security purposes such as investigating abuse, or the law requires it.
  • No other use: data received from Google APIs is never sold, used for advertising, transferred to other parties, or used to develop or train AI or machine-learning models.
  • Incidents: if a security breach affects your data, we will revoke the affected tokens and notify you and, where required, the relevant authorities without undue delay.

5. International transfers

Our servers are located in the EU. Some providers above may process data in other countries; where required, such transfers rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

We keep account and billing data for as long as your subscription is active and as required for legal, tax, and accounting purposes afterward. Your clan’s data is retained while your clan exists on the platform; if you delete your clan we keep it for a short grace period to allow export, then delete it along with associated backups. Ending a paid subscription does not delete your clan’s data — it returns to the free tier.

Images attached to an event — drop and completion screenshots, starting shots, and sign-up fee and payout payment proofs — are deleted 90 days after the event ends. The event’s records (its results, and who submitted or completed what and when) are kept. Before then, a clan’s organisers can download the whole event, images included, as an archive. Payment-proof screenshots may be removed sooner, once the payment they show has been confirmed. Daily database backups are kept for 14 days.

Network codes and countries recorded for account-sharing checks are deleted 30 days after the event ends.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, message us on Discord. If a request concerns data a clan holds about its members, we may direct it to the clan operator who controls that data. You may also lodge a complaint with your local data-protection authority.

8. Cookies

We use strictly necessary cookies to keep you signed in and to operate the service. We do not use advertising cookies. Our payment provider may set cookies during checkout as described in their privacy notice.

Visit statistics

To see how the site is used and where people get stuck, we count page views ourselves, in our own database. We record the kind of page (for example “an event page”, never the address you typed or a player name), the website you arrived from (the site name only), whether your screen is a phone, tablet or desktop, and roughly how long you stayed on a page. A random number held in your browser tab, which disappears when you close it, links one visit’s pages together; it is not a cookie and is not stored on your device afterwards. When you sign in or take a step such as creating a clan or linking the plugin, we may attach your account to that step, and when you create an account we note once where you first came from. No third parties receive any of this, nothing is used for advertising, and we keep it for up to 400 days. If your browser sends Do Not Track or Global Privacy Control, we do not count your visits.

9. Children

The service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will remove it.

10. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app, and the “last updated” date below will change.

11. Contact

For any privacy question or request, message us on Discord.

Last updated: November 8, 2026. Questions? Message us on Discord.